Two Welsh organisations have been formally reprimanded after a ransomware attack on Data Cymru exposed personal information belonging to 3,300 people, most of them children. The UK Information Commissioner's Office said the intrusion began when an attacker exploited a dormant test account named Test2, which had been created in 2012 with the password 'Password1'.
According to the ICO, Ogi Networks created the account during an early project for Data Cymru, a body that helps Welsh public sector organisations use data. The attacker used it to enter the network on November 1, 2024, encrypt 182.7 GB of files, and steal 42 GB of data from a domain controller, file server and SQL server before deploying ransomware.
The regulator found that local administrator accounts on the affected systems shared the same password, allowing the attacker to move across the network once one system was compromised. Neither Ogi Networks nor Data Cymru had proper auditing procedures to review old accounts, and the test account remained active for more than 12 years.
The ICO issued reprimands rather than fines under Article 32 of the UK GDPR, saying both organisations shared responsibility. The Register's report of the ICO's findings is the sole source for these details, and no conflicting accounts were noted.